{"cve":"CVE-2023-2728","nvd":{"published":"2023-07-03T21:15:09.557","modified":"2026-06-17T05:53:18.160","status":"Modified","description":"Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-mountable-secrets` annotation are used together with ephemeral containers.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","score":6.5},"cwes":["CWE-20"],"references":["http://www.openwall.com/lists/oss-security/2023/07/06/3","https://github.com/kubernetes/kubernetes/issues/118640","https://groups.google.com/g/kubernetes-security-announce/c/vPWYJ_L84m8","https://security.netapp.com/advisory/ntap-20230803-0004/","http://www.openwall.com/lists/oss-security/2023/07/06/3"],"products":["kubernetes:kubernetes"],"source":"nvd","synced_at":"2026-10-19T21:38:30.124994567+00:00"},"epss":{"cve":"CVE-2023-2728","score":0.02157,"percentile":0.82187,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-cgcv-5272-97pr","url":"https://osv.dev/vulnerability/GHSA-cgcv-5272-97pr","summary":"Kubernetes mountable secrets policy bypass","modified":"2026-09-10T03:49:57.264938403Z","packages":[{"ecosystem":"Go","name":"k8s.io/kubernetes","purl":"pkg:golang/k8s.io/kubernetes","ranges":[">=1.27.0 <1.27.3"],"fixed":["1.27.3"]},{"ecosystem":"Go","name":"k8s.io/kubernetes","purl":"pkg:golang/k8s.io/kubernetes","ranges":[">=1.26.0 <1.26.6"],"fixed":["1.26.6"]},{"ecosystem":"Go","name":"k8s.io/kubernetes","purl":"pkg:golang/k8s.io/kubernetes","ranges":[">=1.25.0 <1.25.11"],"fixed":["1.25.11"]},{"ecosystem":"Go","name":"k8s.io/kubernetes","purl":"pkg:golang/k8s.io/kubernetes","ranges":["<1.24.15"],"fixed":["1.24.15"]}]},{"id":"GO-2023-1892","url":"https://osv.dev/vulnerability/GO-2023-1892","summary":"Kubernetes mountable secrets policy bypass in k8s.io/kubernetes","modified":"2026-02-04T02:24:08.126010Z","packages":[{"ecosystem":"Go","name":"k8s.io/kubernetes","purl":"pkg:golang/k8s.io/kubernetes","ranges":["<1.24.15",">=1.25.0 <1.25.11",">=1.26.0 <1.26.6",">=1.27.0 <1.27.3"],"fixed":["1.24.15","1.25.11","1.26.6","1.27.3"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}